Is Immich 2.7.0 affected?

CVSS 8.8

9 known vulnerabilities affect 2.7.0 (highest CVSS 8.8).

18 newer releases in its track, up to 3.3.5. What changed up to 3.3.5

Vulnerabilities affecting 2.7.0

8.8
CVE-2026-77439 Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
6.5
GHSA-72rm-x7xr-v679 Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
6.5
GHSA-3mh5-gqfm-phgj Cross-user disclosure of a user's Locked (hidden-vault) assets to a partner via timeline-bucket and search-statistics endpoints
6.1
GHSA-qp2h-w794-2vhf Incomplete fix for login continue redirect allows slash-backslash open redirect
5.1
CVE-2026-40096 Open Redirect via Shared Album name fixed in 2.7.3
4.3
GHSA-hv27-723h-qfjq Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers (the map endpoint omits the archived-asset guard the timeline endpoint enforces)
3.5
GHSA-g4w3-c888-cr93 A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
2.8
GHSA-jrp5-g662-hq92 Unsafe ZIP Entry Names (Zip Slip Class) in Archive Download Endpoint fixed in 3.0.0
low
GHSA-h5w4-vjv4-9r5q Incorrect sanitization of continue URL on the /maintenance endpoint